njrat | 61178fb2ef06748bddd20caddf6c63b8e591d0658b3cb29b901e655169411e6f | Triage

Sharing

General

Target

61178fb2ef06748bddd20caddf6c63b8e591d0658b3cb29b901e655169411e6fN.exe
Size

543KB
Sample

241231-dhnz7atpdz
MD5

5f388982adba14242c5e4ffcc388c1a0
SHA1

8f202feb5a674362826c1e6d8fc5b1a38f86c14b
SHA256

61178fb2ef06748bddd20caddf6c63b8e591d0658b3cb29b901e655169411e6f
SHA512

7ad25e82b45e24d7f76bb9ec3a4ed8dbf497a5f87f1a0f3913d12cf2e1950b4981efe04a3b97b22053ac49e03c75e6fcb2dff2b4fb74f4be088e2f616355e3b4
SSDEEP

12288:2iMmalyw9qfcaF52WgAIsAxOfqV42Rqol0M0pMsRNQSJGmENwMpV:nMigAm3lTaQ

Score

10^/10

njrat victim discovery persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Victim

C2

kgb963.duckdns.org:1115

Mutex

svchost.exe

Attributes

reg_key
svchost.exe
splitter
|Ghost|

Targets

- Target
  
  61178fb2ef06748bddd20caddf6c63b8e591d0658b3cb29b901e655169411e6fN.exe
- Size
  
  543KB
- MD5
  
  5f388982adba14242c5e4ffcc388c1a0
- SHA1
  
  8f202feb5a674362826c1e6d8fc5b1a38f86c14b
- SHA256
  
  61178fb2ef06748bddd20caddf6c63b8e591d0658b3cb29b901e655169411e6f
- SHA512
  
  7ad25e82b45e24d7f76bb9ec3a4ed8dbf497a5f87f1a0f3913d12cf2e1950b4981efe04a3b97b22053ac49e03c75e6fcb2dff2b4fb74f4be088e2f616355e3b4
- SSDEEP
  
  12288:2iMmalyw9qfcaF52WgAIsAxOfqV42Rqol0M0pMsRNQSJGmENwMpV:nMigAm3lTaQ
Score

10^/10

njrat victim discovery persistence trojan
- Modifies WinLogon for persistence
  persistence
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratvictimdiscoverypersistencetrojan

behavioral2

njratvictimdiscoverypersistencetrojan